RE: Snort

Hey Derek. 

Since I'm knee deep in the same activity, I feel your confusion. Here's
what I've learned so far.  The raw log files are exactly that..raw.
Snort was used to record the packets off the wire but only in sniffer
mode, not as an IDS. So you should be able to run the file 2002.9.30
directly into tcpdump using the -r flag:

tcpdump -r 2002.9.30

>From there you can use whatever pcap filters your heart desires.  I've
run into many problems getting snort to work properly so I'm not much
help on that part.  I can tell you that many of the Snort rules require
the packets to be part of an established connection before the rule will
fire.  This is not a problem if you have a connection running between
hosts and Snort listening on the wire.  However, it does make it more
difficult to simply have Snort read the file and try to alert from
there.  The best I've come up with to circumvent this is to remove the
parameter in Snort rules requiring an established connection (flow,
established....I think). I'm sure there are many folks on this list with
oodles more Snort savvy than I so I defer to their feedback on your
Snort questions.  

Good luck. Hope this helps. 

Scott Hazel


-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Buelna, Derek
Sent: Wednesday, October 20, 2004 1:59 PM
To: [email protected]
Subject: [Intrusions] Snort

I'm confused about a couple of things and was hoping for a little
feedback.

I'm analyzing http://isc.sans.org/logs/Raw/2002.9.30
<http://isc.sans.org/logs/Raw/2002.9.30>  as part of my GCIA practical.

The file is a little over 4MB and includes 15021 packets. From what I
understand, only packets that fired against a rule are in there. Is this
true?
My concern is that when I run snort against the file, I get 500 alerts.
As part of this, when I run it in binary output mode, I get a binary log
file that's about 600kB and includes 500 packets! What's the deal with
the remaining 3.4MB worth of packets? Is it possible that these are the
result of custom rules that I'm not aware of? I have all of the rules
turned on, on my snort, although I haven't messed with the
preprocessors.

I'm also not clear on how I can use tcpdump to filter on a few things
and then output a binary that snort can read. I want to run tcpdump on
the 2002.9.30 file with a filter, save the output file and then run it
through snort. When I do this I get no alerts so I think I messed up the
syntax. I was able to create a display filter in ethereal and save that
off and run it through snort though. Maybe I need to output in ASCI and
run a converter on it? 

Any suggestions would be appreciated. Thanks,

Derek A. Buelna, GSEC, CISSP, CCIE #7318 Information Security XEROX
Office Group
Office: 503.685.2593
Fax: 503.685.4140
Email: [email protected]
PGP Fingerprint: F01B F636 ED37 08AD 9D8B 6BCC 5663 F7A4 7F45 4AA5




_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions